SB2026091072 - Multiple vulnerabilities in Keycloak

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026091072

SB2026091072 - Multiple vulnerabilities in Keycloak

Published: September 10, 2026

Security Bulletin ID SB2026091072
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 12
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 25% Low 75%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 12 vulnerabilities.


1) Improper access control (CVE-ID: CVE-2026-4628)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to modify protected resources without authorization.

The vulnerability exists due to improper access control in the User-Managed Access (UMA) resource_set endpoint when handling PUT operations. A remote user can send a PUT request to bypass the allowRemoteResourceManagement=false restriction and modify protected resources.


2) Cross-site scripting (CVE-ID: CVE-2026-37980)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote user to execute arbitrary JavaScript in a user\'s browser.

The vulnerability exists due to improper neutralization of input during web page generation in the organization selection login page when rendering an organization alias in an inline JavaScript onclick handler. A remote privileged user can create an organization alias containing a crafted JavaScript payload to execute arbitrary JavaScript in a user\'s browser.

User interaction is required to view the login page.


3) Improper Validation of Syntactic Correctness of Input (CVE-ID: CVE-2026-7307)

CWE-ID: CWE-1286 - Improper Validation of Syntactic Correctness of Input

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper validation of syntactic correctness of input in the SAML endpoint when processing specially crafted XML input. A remote attacker can send a specially crafted XML input to cause a denial of service.

The malicious input can cause high CPU usage and worker thread starvation, making the server unavailable.


4) Open redirect (CVE-ID: CVE-2026-7504)

CWE-ID: CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to redirect users to unauthorized URLs.

The vulnerability exists due to improper URL validation in Keycloak\'s redirect URI validation logic when processing a malicious redirect URL containing multiple @ characters in the user-info component. A remote attacker can send a crafted redirect request to redirect users to unauthorized URLs.

User interaction is required, and only clients configured with a wildcard (*) in the Valid Redirect URIs field are affected.


5) External Control of Assumed-Immutable Web Parameter (CVE-ID: CVE-2026-7571)

CWE-ID: CWE-472 - External Control of Assumed-Immutable Web Parameter

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to obtain access tokens and disclose sensitive information.

The vulnerability exists due to external control of assumed-immutable web parameters in the OIDC client data handling during session restart when manipulating client data. A remote user can manipulate client data during a session restart to bypass the control that disables the implicit flow and obtain an access token.

Exploitation requires knowledge of user credentials and a client ID. Access tokens may be exposed in server logs, proxy logs, and HTTP Referrer headers.


6) Authentication Bypass by Spoofing (CVE-ID: CVE-2026-7507)

CWE-ID: CWE-290 - Authentication Bypass by Spoofing

CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to take over accounts.

The vulnerability exists due to authentication bypass by spoofing in Keycloak login-actions endpoints when processing a crafted link to the /login-actions/restart endpoint. A remote attacker can pre-create an authentication session and trick a victim into visiting the crafted link to take over accounts.

User interaction is required to visit the crafted link.


7) Authentication Bypass by Capture-replay (CVE-ID: CVE-2026-37982)

CWE-ID: CWE-294 - Authentication Bypass by Capture-replay

CVSSv4: 7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to take over accounts.

The vulnerability exists due to authentication bypass by capture-replay in Keycloak\'s WebAuthn flow when processing an intercepted execute-actions email link. A remote attacker can replay an ExecuteActionsActionToken token and register an authenticator to a victim\'s account to take over accounts.

User interaction is required to access an execute-actions email link.


8) Improper access control (CVE-ID: CVE-2026-37979)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive token claims.

The vulnerability exists due to improper access control in Keycloak\'s OpenID Connect token introspection endpoint when processing introspection requests from confidential clients. A remote user can use valid confidential-client credentials to bypass audience restrictions and disclose sensitive token claims.

Lightweight access tokens are affected.


9) Authorization bypass through user-controlled key (CVE-ID: CVE-2026-37978)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose personally identifiable information.

The vulnerability exists due to authorization bypass through a user-controlled key in the evaluate-scopes Admin API endpoints when invoking the endpoints with an arbitrary user ID parameter. A remote privileged user can submit an arbitrary user ID to view user identities and authorizations across the realm.

The issue affects administrators assigned the view-clients role.


10) Authorization bypass through user-controlled key (CVE-ID: CVE-2026-4630)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 7.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose information and modify or delete data.

The vulnerability exists due to authorization bypass through a user-controlled key in the Authorization Services Protection API endpoint when handling requests that specify the UUID of a resource owned by another Resource Server in the same realm. A remote user can send GET, PUT, or DELETE requests using a known or obtained resource UUID to disclose information and modify or delete data.


11) Insufficient Granularity of Access Control (CVE-ID: CVE-2026-37981)

CWE-ID: CWE-1220 - Insufficient Granularity of Access Control

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose personally identifiable information for realm users.

The vulnerability exists due to insufficient granularity of access control in the Keycloak Account Resources user lookup endpoint when handling crafted requests containing arbitrary usernames or email values. A remote user can send crafted requests to enumerate realm users and retrieve full profile objects for unrelated users to disclose personally identifiable information for realm users.

Exploitation requires ownership of at least one User-Managed Access (UMA) resource.


12) Insufficient verification of data authenticity (CVE-ID: CVE-2026-6856)

CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to bypass acceptable AAGUID policy.

The vulnerability exists due to improper attestation validation in WebAuthn registration when processing packed self-attestation while direct attestation is requested. A remote user can register an authenticator using packed self-attestation to bypass acceptable AAGUID policy.

The AAGUID is unverified when the authenticator does not provide an x5c certificate chain.


Remediation

Install update from vendor's website.

References